set umask as early as possible